@masheev/better-auth 0.0.0-stage → 1.7.5

package/dist/plugins/access/access.mjs

@@ -0,0 +1,78 @@
+import { BetterAuthError } from "@better-auth/core/error";
+//#region src/plugins/access/access.ts
+function unknownResourceResponse(requestedResource) {
+	return {
+		success: false,
+		error: `You are not allowed to access resource: ${requestedResource}`
+	};
+}
+function unauthorizedResourceResponse(requestedResource) {
+	return {
+		success: false,
+		error: `unauthorized to access resource "${requestedResource}"`
+	};
+}
+function normalizeConnector(connector) {
+	return connector === "OR" ? "OR" : "AND";
+}
+function isActionList(actions) {
+	return Array.isArray(actions);
+}
+function normalizeActionRequest(requestedActions) {
+	if (isActionList(requestedActions)) return {
+		actions: requestedActions,
+		connector: "AND"
+	};
+	if (!requestedActions || typeof requestedActions !== "object") throw new BetterAuthError("Invalid access control request");
+	const { actions, connector } = requestedActions;
+	if (!isActionList(actions)) return {
+		actions: [],
+		connector: normalizeConnector(connector)
+	};
+	return {
+		actions,
+		connector: normalizeConnector(connector)
+	};
+}
+function hasAllowedAction(allowedActions, requestedAction) {
+	return typeof requestedAction === "string" && allowedActions.includes(requestedAction);
+}
+function isResourceAuthorized(allowedActions, { actions, connector }) {
+	if (actions.length === 0) return false;
+	if (connector === "OR") return actions.some((requestedAction) => hasAllowedAction(allowedActions, requestedAction));
+	return actions.every((requestedAction) => hasAllowedAction(allowedActions, requestedAction));
+}
+function role(statements) {
+	return {
+		authorize(request, connector = "AND") {
+			let hasAuthorizedResource = false;
+			for (const [requestedResource, requestedActions] of Object.entries(request)) {
+				const allowedActions = statements[requestedResource];
+				if (!allowedActions) {
+					if (connector === "AND") return unknownResourceResponse(requestedResource);
+					continue;
+				}
+				const isAuthorized = isResourceAuthorized(allowedActions, normalizeActionRequest(requestedActions));
+				if (isAuthorized) hasAuthorizedResource = true;
+				if (isAuthorized && connector === "OR") return { success: true };
+				if (!isAuthorized && connector === "AND") return unauthorizedResourceResponse(requestedResource);
+			}
+			if (hasAuthorizedResource) return { success: true };
+			return {
+				success: false,
+				error: "Not authorized"
+			};
+		},
+		statements
+	};
+}
+function createAccessControl(s) {
+	return {
+		newRole(statements) {
+			return role(statements);
+		},
+		statements: s
+	};
+}
+//#endregion
+export { createAccessControl, role };

package/dist/plugins/access/index.d.mts

@@ -0,0 +1,3 @@
+import { AccessControl, ArrayElement, ExactRoleStatements, Role, RoleAuthorizeRequest, RoleInput, RoleStatements, Statements, SubArray, Subset } from "./types.mjs";
+import { AuthorizeResponse, createAccessControl, role } from "./access.mjs";
+export { AccessControl, ArrayElement, AuthorizeResponse, ExactRoleStatements, Role, RoleAuthorizeRequest, RoleInput, RoleStatements, Statements, SubArray, Subset, createAccessControl, role };

package/dist/plugins/access/index.mjs

@@ -0,0 +1,2 @@
+import { createAccessControl, role } from "./access.mjs";
+export { createAccessControl, role };

package/dist/plugins/access/types.d.mts

@@ -0,0 +1,24 @@
+import { AuthorizeResponse, createAccessControl } from "./access.mjs";
+import { LiteralString } from "@better-auth/core";
+
+//#region src/plugins/access/types.d.ts
+type ArrayElement<T> = T extends readonly (infer E)[] ? E : never;
+type SubArray<T extends unknown[] | readonly unknown[] | any[]> = T[number][] | ReadonlyArray<T[number]>;
+type Subset<K extends keyof R, R extends Record<string | LiteralString, readonly string[] | readonly LiteralString[]>> = { [P in K]: SubArray<R[P]> };
+type Statements = {
+  readonly [resource: string]: readonly LiteralString[];
+};
+type RoleStatements<TStatements extends Statements> = { readonly [P in keyof TStatements]?: SubArray<TStatements[P]> };
+type RoleInput<TStatements extends Statements, TRoleStatements extends Statements> = TRoleStatements & (string extends keyof TRoleStatements ? {} : RoleStatements<TStatements> & Record<Exclude<keyof TRoleStatements, keyof TStatements>, never>);
+type ExactRoleStatements<TStatements extends Statements> = { readonly [P in keyof TStatements]: readonly [...TStatements[P]] };
+type AccessControl<TStatements extends Statements = Statements> = ReturnType<typeof createAccessControl<TStatements>>;
+type RoleAuthorizeRequest<TStatements extends Statements> = { [P in keyof TStatements]?: SubArray<TStatements[P]> | {
+  actions: SubArray<TStatements[P]>;
+  connector: "OR" | "AND";
+} };
+type Role<TRoleStatements extends Statements = Record<string, any>, TAuthorizeStatements extends Statements = TRoleStatements> = {
+  authorize: (request: RoleAuthorizeRequest<TAuthorizeStatements>, connector?: ("OR" | "AND") | undefined) => AuthorizeResponse;
+  statements: TRoleStatements;
+};
+//#endregion
+export { AccessControl, ArrayElement, ExactRoleStatements, Role, RoleAuthorizeRequest, RoleInput, RoleStatements, Statements, SubArray, Subset };

package/dist/plugins/additional-fields/client.d.mts

@@ -0,0 +1,100 @@
+import { BetterAuthOptions, BetterAuthPlugin } from "@better-auth/core";
+import { DBFieldAttribute } from "@better-auth/core/db";
+
+//#region src/plugins/additional-fields/client.d.ts
+declare const inferAdditionalFields: <T, S extends {
+  user?: {
+    [key: string]: DBFieldAttribute;
+  } | undefined;
+  session?: {
+    [key: string]: DBFieldAttribute;
+  } | undefined;
+} = {}>(schema?: S | undefined) => {
+  id: "additional-fields-client";
+  version: string;
+  $InferServerPlugin: ((T extends BetterAuthOptions ? T : T extends {
+    options: BetterAuthOptions;
+  } ? T["options"] : never) extends never ? S extends {
+    user?: {
+      [key: string]: DBFieldAttribute;
+    } | undefined;
+    session?: {
+      [key: string]: DBFieldAttribute;
+    } | undefined;
+  } ? {
+    id: "additional-fields-client";
+    version: string;
+    schema: {
+      user: {
+        fields: S["user"] extends object ? S["user"] : {};
+      };
+      session: {
+        fields: S["session"] extends object ? S["session"] : {};
+      };
+    };
+  } : never : (T extends BetterAuthOptions ? T : T extends {
+    options: BetterAuthOptions;
+  } ? T["options"] : never) extends BetterAuthOptions ? {
+    id: "additional-fields";
+    version: string;
+    schema: {
+      user: {
+        fields: (T extends BetterAuthOptions ? T : T extends {
+          options: BetterAuthOptions;
+        } ? T["options"] : never)["user"] extends {
+          additionalFields: infer U;
+        } ? U : {};
+      };
+      session: {
+        fields: (T extends BetterAuthOptions ? T : T extends {
+          options: BetterAuthOptions;
+        } ? T["options"] : never)["session"] extends {
+          additionalFields: infer U;
+        } ? U : {};
+      };
+    };
+  } : never) extends BetterAuthPlugin ? (T extends BetterAuthOptions ? T : T extends {
+    options: BetterAuthOptions;
+  } ? T["options"] : never) extends never ? S extends {
+    user?: {
+      [key: string]: DBFieldAttribute;
+    } | undefined;
+    session?: {
+      [key: string]: DBFieldAttribute;
+    } | undefined;
+  } ? {
+    id: "additional-fields-client";
+    version: string;
+    schema: {
+      user: {
+        fields: S["user"] extends object ? S["user"] : {};
+      };
+      session: {
+        fields: S["session"] extends object ? S["session"] : {};
+      };
+    };
+  } : never : (T extends BetterAuthOptions ? T : T extends {
+    options: BetterAuthOptions;
+  } ? T["options"] : never) extends BetterAuthOptions ? {
+    id: "additional-fields";
+    version: string;
+    schema: {
+      user: {
+        fields: (T extends BetterAuthOptions ? T : T extends {
+          options: BetterAuthOptions;
+        } ? T["options"] : never)["user"] extends {
+          additionalFields: infer U;
+        } ? U : {};
+      };
+      session: {
+        fields: (T extends BetterAuthOptions ? T : T extends {
+          options: BetterAuthOptions;
+        } ? T["options"] : never)["session"] extends {
+          additionalFields: infer U;
+        } ? U : {};
+      };
+    };
+  } : never : undefined;
+};
+//#endregion
+export { inferAdditionalFields };

package/dist/plugins/additional-fields/client.mjs

@@ -0,0 +1,11 @@
+import { PACKAGE_VERSION } from "../../version.mjs";
+//#region src/plugins/additional-fields/client.ts
+const inferAdditionalFields = (schema) => {
+	return {
+		id: "additional-fields-client",
+		version: PACKAGE_VERSION,
+		$InferServerPlugin: {}
+	};
+};
+//#endregion
+export { inferAdditionalFields };

package/dist/plugins/admin/access/index.d.mts

@@ -0,0 +1,2 @@
+import { adminAc, defaultAc, defaultRoles, defaultStatements, userAc } from "./statement.mjs";
+export { adminAc, defaultAc, defaultRoles, defaultStatements, userAc };

package/dist/plugins/admin/access/index.mjs

@@ -0,0 +1,2 @@
+import { adminAc, defaultAc, defaultRoles, defaultStatements, userAc } from "./statement.mjs";
+export { adminAc, defaultAc, defaultRoles, defaultStatements, userAc };

package/dist/plugins/admin/access/statement.d.mts

@@ -0,0 +1,51 @@
+import { ExactRoleStatements, Role, RoleInput, Statements } from "../../access/types.mjs";
+//#region src/plugins/admin/access/statement.d.ts
+declare const defaultStatements: {
+  readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
+  readonly session: readonly ["list", "revoke", "delete"];
+};
+declare const defaultAc: {
+  newRole<const TRoleStatements extends Statements>(statements: RoleInput<{
+    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
+    readonly session: readonly ["list", "revoke", "delete"];
+  }, TRoleStatements>): Role<ExactRoleStatements<TRoleStatements>, {
+    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
+    readonly session: readonly ["list", "revoke", "delete"];
+  }>;
+  statements: {
+    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
+    readonly session: readonly ["list", "revoke", "delete"];
+  };
+};
+declare const adminAc: Role<ExactRoleStatements<{
+  readonly user: ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "set-email", "get", "update"];
+  readonly session: ["list", "revoke", "delete"];
+}>, {
+  readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
+  readonly session: readonly ["list", "revoke", "delete"];
+}>;
+declare const userAc: Role<ExactRoleStatements<{
+  readonly user: [];
+  readonly session: [];
+}>, {
+  readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
+  readonly session: readonly ["list", "revoke", "delete"];
+}>;
+declare const defaultRoles: {
+  admin: Role<ExactRoleStatements<{
+    readonly user: ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "set-email", "get", "update"];
+    readonly session: ["list", "revoke", "delete"];
+  }>, {
+    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
+    readonly session: readonly ["list", "revoke", "delete"];
+  }>;
+  user: Role<ExactRoleStatements<{
+    readonly user: [];
+    readonly session: [];
+  }>, {
+    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
+    readonly session: readonly ["list", "revoke", "delete"];
+  }>;
+};
+//#endregion
+export { adminAc, defaultAc, defaultRoles, defaultStatements, userAc };

package/dist/plugins/admin/access/statement.mjs

@@ -0,0 +1,52 @@
+import { createAccessControl } from "../../access/access.mjs";
+//#region src/plugins/admin/access/statement.ts
+const defaultStatements = {
+	user: [
+		"create",
+		"list",
+		"set-role",
+		"ban",
+		"impersonate",
+		"impersonate-admins",
+		"delete",
+		"set-password",
+		"set-email",
+		"get",
+		"update"
+	],
+	session: [
+		"list",
+		"revoke",
+		"delete"
+	]
+};
+const defaultAc = createAccessControl(defaultStatements);
+const adminAc = defaultAc.newRole({
+	user: [
+		"create",
+		"list",
+		"set-role",
+		"ban",
+		"impersonate",
+		"delete",
+		"set-password",
+		"set-email",
+		"get",
+		"update"
+	],
+	session: [
+		"list",
+		"revoke",
+		"delete"
+	]
+});
+const userAc = defaultAc.newRole({
+	user: [],
+	session: []
+});
+const defaultRoles = {
+	admin: adminAc,
+	user: userAc
+};
+//#endregion
+export { adminAc, defaultAc, defaultRoles, defaultStatements, userAc };